CVE-2025-56092
Published: 11 December 2025
Summary
CVE-2025-56092 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie Rg-Ew300T Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by requiring validation mechanisms for crafted POST requests to the module_get function in networkConnect.lua.
Requires timely identification, reporting, and patching of the specific OS command injection flaw in the vulnerable Lua script.
Enforces restrictions on POST request inputs to block command injection payloads targeting the networkConnect.lua module.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote exploitation of a public-facing web application via crafted POST request (T1190), resulting in arbitrary OS command injection and Unix shell execution (T1059.004).
NVD Description
OS Command Injection vulnerability in Ruijie X30 PRO V1 X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Deeper analysisAI
CVE-2025-56092 is an OS Command Injection vulnerability (CWE-78) affecting the Ruijie X30 PRO V1 device, specifically version X30-PRO-V1_09241521. The flaw resides in the module_get function within the file /usr/local/lua/dev_sta/networkConnect.lua, where attackers can execute arbitrary operating system commands by sending a crafted POST request. Published on 2025-12-11, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
The vulnerability can be exploited remotely over the network by attackers who possess low privileges (PR:L), requiring low attack complexity and no user interaction. Successful exploitation allows arbitrary command execution on the underlying operating system, potentially enabling full system compromise, data exfiltration, persistence, or further lateral movement within the affected network environment.
Advisories and detailed reports on mitigation, including potential patches or workarounds, are available in the referenced sources: https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY, https://1drv.ms/t/c/12406a392c92914b/EaD98URfTfFKm1v_MTfU-UEBUxRf5vj3O0x7fhabn5_l9A?e=BuNPV9, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56091.md. Security practitioners should consult these for vendor-specific remediation guidance.
Details
- CWE(s)